https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 23:14:08 +0000 https://vulnerability.circl.lu/sighting/0fc31771-a4b2-4fe0-8f40-c64e1ab5293f/export {"uuid": "0fc31771-a4b2-4fe0-8f40-c64e1ab5293f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105853", "type": "seen", "source": "https://gist.github.com/alon710/63205d59d63f7a0fa04234012bcf2681", "content": "# CVE-2026-105853: CVE-2026-105853: Sensitive Information Disclosure and Authentication Collection Boundary Bypass in Payload CMS\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105853\n\n## Summary\nCVE-2026-105853 is a high-severity information disclosure vulnerability in Payload CMS that affects authentication-enabled collections. In vulnerable versions, the application fails to properly serialize and sanitize user documents during token refresh and password reset operations. This deficiency leaks hidden and read-restricted fields to unauthorized actors. Additionally, a logical flaw in token refresh validation allows low-privileged users to cross collection boundaries, exposing sensitive configuration details and administrative metadata.\n\n## TL;DR\nPayload CMS fails to sanitize user documents in password reset and token refresh endpoints, allowing low-privileged authenticated users to access hidden or read-restricted fields across collection boundaries.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 7.1\n- **EPSS Score**: Not yet populated\n- **Impact**: High Confidentiality Exposure\n- **Exploit Status**: poc\n- **KEV Status**: No\n\n## Affected Systems\n\n- Payload CMS installations with multiple authentication-enabled collections\n- Payload CMS installations with custom fields marked as hidden\n- **payload**: >= 3.0.0, < 3.90.0 (Fixed in: `3.90.0`)\n- **payload**: >= 4.0.0-canary.0, < 4.0.0-canary.34 (Fixed in: `4.0.0-canary.34`)\n\n## Mitigation\n\n- Upgrade Payload CMS dependencies to versions that contain the official security patches.\n- Manually review and sanitize user documents returned by custom authentication handlers.\n- Deploy WAF rules to monitor and block cross-collection token refresh requests.\n\n**Remediation Steps:**\n1. Identify the current version of Payload CMS running in the package.json file.\n2. Upgrade the package to version 3.90.0 or higher for 3.x branches, or version 4.0.0-canary.34 or higher for 4.x branches.\n3. Rebuild and redeploy the application.\n4. Inspect custom authentication strategies and ensure they apply appropriate sanitization wrappers.\n\n## References\n\n- [GitHub Security Advisory GHSA-xgv3-crq2-6f69](https://github.com/payloadcms/payload/security/advisories/GHSA-xgv3-crq2-6f69)\n- [Fix Commit (Token Refresh Collection Boundary)](https://github.com/payloadcms/payload/commit/f5f1283d275c58b30e2faa6be7cdc4d49451ea91)\n- [Payload CMS Release Version 3.90.0](https://github.com/payloadcms/payload/releases/tag/v3.90.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105853) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T23:30:31.000000Z"} {"uuid": "0fc31771-a4b2-4fe0-8f40-c64e1ab5293f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105853", "type": "seen", "source": "https://gist.github.com/alon710/63205d59d63f7a0fa04234012bcf2681", "content": "# CVE-2026-105853: CVE-2026-105853: Sensitive Information Disclosure and Authentication Collection Boundary Bypass in Payload CMS\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105853\n\n## Summary\nCVE-2026-105853 is a high-severity information disclosure vulnerability in Payload CMS that affects authentication-enabled collections. In vulnerable versions, the application fails to properly serialize and sanitize user documents during token refresh and password reset operations. This deficiency leaks hidden and read-restricted fields to unauthorized actors. Additionally, a logical flaw in token refresh validation allows low-privileged users to cross collection boundaries, exposing sensitive configuration details and administrative metadata.\n\n## TL;DR\nPayload CMS fails to sanitize user documents in password reset and token refresh endpoints, allowing low-privileged authenticated users to access hidden or read-restricted fields across collection boundaries.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 7.1\n- **EPSS Score**: Not yet populated\n- **Impact**: High Confidentiality Exposure\n- **Exploit Status**: poc\n- **KEV Status**: No\n\n## Affected Systems\n\n- Payload CMS installations with multiple authentication-enabled collections\n- Payload CMS installations with custom fields marked as hidden\n- **payload**: >= 3.0.0, < 3.90.0 (Fixed in: `3.90.0`)\n- **payload**: >= 4.0.0-canary.0, < 4.0.0-canary.34 (Fixed in: `4.0.0-canary.34`)\n\n## Mitigation\n\n- Upgrade Payload CMS dependencies to versions that contain the official security patches.\n- Manually review and sanitize user documents returned by custom authentication handlers.\n- Deploy WAF rules to monitor and block cross-collection token refresh requests.\n\n**Remediation Steps:**\n1. Identify the current version of Payload CMS running in the package.json file.\n2. Upgrade the package to version 3.90.0 or higher for 3.x branches, or version 4.0.0-canary.34 or higher for 4.x branches.\n3. Rebuild and redeploy the application.\n4. Inspect custom authentication strategies and ensure they apply appropriate sanitization wrappers.\n\n## References\n\n- [GitHub Security Advisory GHSA-xgv3-crq2-6f69](https://github.com/payloadcms/payload/security/advisories/GHSA-xgv3-crq2-6f69)\n- [Fix Commit (Token Refresh Collection Boundary)](https://github.com/payloadcms/payload/commit/f5f1283d275c58b30e2faa6be7cdc4d49451ea91)\n- [Payload CMS Release Version 3.90.0](https://github.com/payloadcms/payload/releases/tag/v3.90.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105853) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T23:30:31.000000Z"} https://vulnerability.circl.lu/sighting/0fc31771-a4b2-4fe0-8f40-c64e1ab5293f/export Tue, 06 Oct 2026 23:30:31 +0000